Firefox Support Forum

Hi guys,

I don't know when and how exactly this thing was added to my firefox behind my back, I don't like it, I don't like Baidu Pan either but I have to use it.

I checked the extensions and add-ons, nothing suspicious was found.

Can you please help me remove it?

Just got a page hijack -- first in quite a while. I was on a car owner forum page when this took over it: (image attached)

Note this rogue page is https! https://getakamaigreattheclicks.best/u_9_f9g-ooEc-qICvlksjMFSmOtGxgos15KRASCIkXw?cid=whb5uaiequuqjjd2ida2f1se&sid=&uid=LBMtFKLEQFoRVia9qmWChgjj

Anyone else seeing this? McAfee did not pick up on this.

Troubleshooting information: Application Basics

Name: Firefox Version: 81.0 Build ID: 20200917005511 Distribution ID: Update Channel: release User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 OS: Windows_NT 10.0 19041 Launcher Process: Enabled Multiprocess Windows: 4/4 Enabled by default Remote Processes: 11 Enterprise Policies: Inactive Google Location Service Key: Found Google Safebrowsing Key: Found Mozilla Location Service Key: Found Safe Mode: false

Crash Reports for the Last 3 Days

Firefox Features

Name: DoH Roll-Out Version: 2.0.0 ID: doh-rollout@mozilla.org

Name: Firefox Screenshots Version: 39.0.0 ID: screenshots@mozilla.org

Name: Form Autofill Version: 1.0 ID: formautofill@mozilla.org

Name: Web Compat Version: 14.0.0 ID: webcompat@mozilla.org

Name: WebCompat Reporter Version: 1.4.0 ID: webcompat-reporter@mozilla.org

Remote Processes

Type: Web Content Count: 8 / 8

Type: Privileged About Count: 1

Type: Extension Count: 1

Type: GPU Count: 1

Add-ons

Name: Amazon.com Type: extension Version: 1.3 Enabled: true ID: amazondotcom@search.mozilla.org

Name: Bing Type: extension Version: 1.2 Enabled: true ID: bing@search.mozilla.org

Name: DuckDuckGo Type: extension Version: 1.1 Enabled: true ID: ddg@search.mozilla.org

Name: eBay Type: extension Version: 1.2 Enabled: true ID: ebay@search.mozilla.org

Name: Google Type: extension Version: 1.1 Enabled: true ID: google@search.mozilla.org

Name: McAfee® WebAdvisor Type: extension Version: 8.1.0.122 Enabled: true ID: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}

Name: Wikipedia (en) Type: extension Version: 1.1 Enabled: true ID: wikipedia@search.mozilla.org

Name: WOT Web of Trust, Website Reputation Ratings Type: extension Version: 20200909.0wot Enabled: true ID: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

Name: McAfee® Web Boost Type: extension Version: 1.0.0.25006 Enabled: false ID: {EF0645D5-78D6-4B33-BC45-95B1874977AF}

Name: Norton Security Toolbar Type: extension Version: 2017.9.2.2 Enabled: false ID: {C1A2A613-35F1-4FCF-B27F-2840527B6556}

Security Software

Type: McAfee VirusScan

Type:

Type: McAfee Firewall

Graphics

Features Compositing: Direct3D 11 (Advanced Layers) Asynchronous Pan/Zoom: wheel input enabled; scrollbar drag enabled; keyboard enabled; autoscroll enabled WebGL 1 Driver WSI Info: EGL_VENDOR: Google Inc. (adapter LUID: 0000000000018273) EGL_VERSION: 1.4 (ANGLE 2.1.0.6c72b64f910d) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_d3d_texture_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_ANGLE_direct_composition EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_EXT_device_query EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_get_all_proc_addresses EGL_KHR_stream EGL_KHR_stream_consumer_gltexture EGL_NV_stream_consumer_gltexture_yuv EGL_ANGLE_flexible_surface_compatibility EGL_ANGLE_stream_producer_d3d_texture EGL_ANGLE_create_context_webgl_compatibility EGL_CHROMIUM_create_context_bind_generates_resource EGL_CHROMIUM_sync_control EGL_EXT_pixel_format_float EGL_KHR_surfaceless_context EGL_ANGLE_display_texture_share_group EGL_ANGLE_create_context_client_arrays EGL_ANGLE_program_cache_control EGL_ANGLE_robust_resource_initialization EGL_ANGLE_create_context_extensions_enabled EGL_ANDROID_blob_cache EGL_ANDROID_recordable EGL_ANGLE_image_d3d11_texture EGL_ANGLE_create_context_backwards_compatible EGL_EXTENSIONS(nullptr): EGL_EXT_client_extensions EGL_EXT_platform_base EGL_EXT_platform_device EGL_ANGLE_platform_angle EGL_ANGLE_platform_angle_d3d EGL_ANGLE_device_creation EGL_ANGLE_device_creation_d3d11 EGL_ANGLE_experimental_present_path EGL_KHR_client_get_all_proc_addresses EGL_KHR_debug EGL_ANGLE_explicit_context EGL_ANGLE_feature_control WebGL 1 Driver Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics 620 Direct3D11 vs_5_0 ps_5_0) WebGL 1 Driver Version: OpenGL ES 2.0.0 (ANGLE 2.1.0.6c72b64f910d) WebGL 1 Driver Extensions: GL_ANGLE_client_arrays GL_ANGLE_depth_texture GL_ANGLE_explicit_context GL_ANGLE_explicit_context_gles1 GL_ANGLE_framebuffer_blit GL_ANGLE_framebuffer_multisample GL_ANGLE_instanced_arrays GL_ANGLE_lossy_etc_decode GL_ANGLE_memory_size GL_ANGLE_multi_draw GL_ANGLE_multiview_multisample GL_ANGLE_pack_reverse_row_order GL_ANGLE_program_cache_control GL_ANGLE_provoking_vertex GL_ANGLE_request_extension GL_ANGLE_robust_client_memory GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_ANGLE_texture_usage GL_ANGLE_translated_shader_source GL_CHROMIUM_bind_generates_resource GL_CHROMIUM_bind_uniform_location GL_CHROMIUM_color_buffer_float_rgb GL_CHROMIUM_color_buffer_float_rgba GL_CHROMIUM_copy_compressed_texture GL_CHROMIUM_copy_texture GL_CHROMIUM_lose_context GL_CHROMIUM_sync_query GL_EXT_blend_func_extended GL_EXT_blend_minmax GL_EXT_color_buffer_half_float GL_EXT_debug_marker GL_EXT_discard_framebuffer GL_EXT_disjoint_timer_query GL_EXT_draw_buffers GL_EXT_float_blend GL_EXT_frag_depth GL_EXT_instanced_arrays GL_EXT_map_buffer_range GL_EXT_occlusion_query_boolean GL_EXT_read_format_bgra GL_EXT_robustness GL_EXT_sRGB GL_EXT_shader_texture_lod GL_EXT_texture_compression_bptc GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_s3tc_srgb GL_EXT_texture_filter_anisotropic GL_EXT_texture_format_BGRA8888 GL_EXT_texture_rg GL_EXT_texture_storage GL_EXT_unpack_subimage GL_KHR_debug GL_KHR_parallel_shader_compile GL_KHR_robust_buffer_access_behavior GL_NV_EGL_stream_consumer_external GL_NV_fence GL_NV_pack_subimage GL_NV_pixel_buffer_object GL_OES_EGL_image GL_OES_EGL_image_external GL_OES_depth24 GL_OES_depth32 GL_OES_element_index_uint GL_OES_get_program_binary GL_OES_mapbuffer GL_OES_packed_depth_stencil GL_OES_rgb8_rgba8 GL_OES_standard_derivatives GL_OES_surfaceless_context GL_OES_texture_3D GL_OES_texture_border_clamp GL_OES_texture_float GL_OES_texture_float_linear GL_OES_texture_half_float GL_OES_texture_half_float_linear GL_OES_texture_npot GL_OES_vertex_array_object OES_compressed_EAC_R11_signed_texture OES_compressed_EAC_R11_unsigned_texture OES_compressed_EAC_RG11_signed_texture OES_compressed_EAC_RG11_unsigned_texture OES_compressed_ETC2_RGB8_texture OES_compressed_ETC2_RGBA8_texture OES_compressed_ETC2_punchthroughA_RGBA8_texture OES_compressed_ETC2_punchthroughA_sRGB8_alpha_texture OES_compressed_ETC2_sRGB8_alpha8_texture OES_compressed_ETC2_sRGB8_texture WebGL 1 Extensions: ANGLE_instanced_arrays EXT_blend_minmax EXT_color_buffer_half_float EXT_float_blend EXT_frag_depth EXT_shader_texture_lod EXT_sRGB EXT_texture_compression_bptc EXT_texture_filter_anisotropic MOZ_debug OES_element_index_uint OES_standard_derivatives OES_texture_float OES_texture_float_linear OES_texture_half_float OES_texture_half_float_linear OES_vertex_array_object WEBGL_color_buffer_float WEBGL_compressed_texture_s3tc WEBGL_compressed_texture_s3tc_srgb WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_depth_texture WEBGL_draw_buffers WEBGL_lose_context WebGL 2 Driver WSI Info: EGL_VENDOR: Google Inc. (adapter LUID: 0000000000018273) EGL_VERSION: 1.4 (ANGLE 2.1.0.6c72b64f910d) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_d3d_texture_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_ANGLE_direct_composition EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_EXT_device_query EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_get_all_proc_addresses EGL_KHR_stream EGL_KHR_stream_consumer_gltexture EGL_NV_stream_consumer_gltexture_yuv EGL_ANGLE_flexible_surface_compatibility EGL_ANGLE_stream_producer_d3d_texture EGL_ANGLE_create_context_webgl_compatibility EGL_CHROMIUM_create_context_bind_generates_resource EGL_CHROMIUM_sync_control EGL_EXT_pixel_format_float EGL_KHR_surfaceless_context EGL_ANGLE_display_texture_share_group EGL_ANGLE_create_context_client_arrays EGL_ANGLE_program_cache_control EGL_ANGLE_robust_resource_initialization EGL_ANGLE_create_context_extensions_enabled EGL_ANDROID_blob_cache EGL_ANDROID_recordable EGL_ANGLE_image_d3d11_texture EGL_ANGLE_create_context_backwards_compatible EGL_EXTENSIONS(nullptr): EGL_EXT_client_extensions EGL_EXT_platform_base EGL_EXT_platform_device EGL_ANGLE_platform_angle EGL_ANGLE_platform_angle_d3d EGL_ANGLE_device_creation EGL_ANGLE_device_creation_d3d11 EGL_ANGLE_experimental_present_path EGL_KHR_client_get_all_proc_addresses EGL_KHR_debug EGL_ANGLE_explicit_context EGL_ANGLE_feature_control WebGL 2 Driver Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics 620 Direct3D11 vs_5_0 ps_5_0) WebGL 2 Driver Version: OpenGL ES 3.0.0 (ANGLE 2.1.0.6c72b64f910d) WebGL 2 Driver Extensions: GL_ANGLE_client_arrays GL_ANGLE_copy_texture_3d GL_ANGLE_depth_texture GL_ANGLE_explicit_context GL_ANGLE_explicit_context_gles1 GL_ANGLE_framebuffer_blit GL_ANGLE_framebuffer_multisample GL_ANGLE_instanced_arrays GL_ANGLE_lossy_etc_decode GL_ANGLE_memory_size GL_ANGLE_multi_draw GL_ANGLE_multiview_multisample GL_ANGLE_pack_reverse_row_order GL_ANGLE_program_cache_control GL_ANGLE_provoking_vertex GL_ANGLE_request_extension GL_ANGLE_robust_client_memory GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_ANGLE_texture_multisample GL_ANGLE_texture_usage GL_ANGLE_translated_shader_source GL_CHROMIUM_bind_generates_resource GL_CHROMIUM_bind_uniform_location GL_CHROMIUM_color_buffer_float_rgb GL_CHROMIUM_color_buffer_float_rgba GL_CHROMIUM_copy_compressed_texture GL_CHROMIUM_copy_texture GL_CHROMIUM_lose_context GL_CHROMIUM_sync_query GL_EXT_blend_func_extended GL_EXT_blend_minmax GL_EXT_color_buffer_float GL_EXT_color_buffer_half_float GL_EXT_debug_marker GL_EXT_discard_framebuffer GL_EXT_disjoint_timer_query GL_EXT_draw_buffers GL_EXT_float_blend GL_EXT_frag_depth GL_EXT_instanced_arrays GL_EXT_map_buffer_range GL_EXT_occlusion_query_boolean GL_EXT_read_format_bgra GL_EXT_robustness GL_EXT_sRGB GL_EXT_shader_texture_lod GL_EXT_texture_compression_bptc GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_s3tc_srgb GL_EXT_texture_filter_anisotropic GL_EXT_texture_format_BGRA8888 GL_EXT_texture_norm16 GL_EXT_texture_rg GL_EXT_texture_storage GL_EXT_unpack_subimage GL_KHR_debug GL_KHR_parallel_shader_compile GL_KHR_robust_buffer_access_behavior GL_NV_EGL_stream_consumer_external GL_NV_fence GL_NV_pack_subimage GL_NV_pixel_buffer_object GL_OES_EGL_image GL_OES_EGL_image_external GL_OES_EGL_image_external_essl3 GL_OES_depth24 GL_OES_depth32 GL_OES_element_index_uint GL_OES_get_program_binary GL_OES_mapbuffer GL_OES_packed_depth_stencil GL_OES_rgb8_rgba8 GL_OES_standard_derivatives GL_OES_surfaceless_context GL_OES_texture_3D GL_OES_texture_border_clamp GL_OES_texture_float GL_OES_texture_float_linear GL_OES_texture_half_float GL_OES_texture_half_float_linear GL_OES_texture_npot GL_OES_vertex_array_object GL_OVR_multiview GL_OVR_multiview2 OES_compressed_EAC_R11_signed_texture OES_compressed_EAC_R11_unsigned_texture OES_compressed_EAC_RG11_signed_texture OES_compressed_EAC_RG11_unsigned_texture OES_compressed_ETC2_RGB8_texture OES_compressed_ETC2_RGBA8_texture OES_compressed_ETC2_punchthroughA_RGBA8_texture OES_compressed_ETC2_punchthroughA_sRGB8_alpha_texture OES_compressed_ETC2_sRGB8_alpha8_texture OES_compressed_ETC2_sRGB8_texture WebGL 2 Extensions: EXT_color_buffer_float EXT_float_blend EXT_texture_compression_bptc EXT_texture_filter_anisotropic MOZ_debug OES_texture_float_linear OVR_multiview2 WEBGL_compressed_texture_s3tc WEBGL_compressed_texture_s3tc_srgb WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_lose_context Direct2D: true Off Main Thread Painting Enabled: true Off Main Thread Painting Worker Count: 3 Target Frame Rate: 60 DirectWrite: true (10.0.19041.388) GPU #1 Active: Yes Description: Intel(R) HD Graphics 620 Vendor ID: 0x8086 Device ID: 0x5916 Driver Version: 21.20.16.4542 Driver Date: 10-24-2016 Drivers: igdumdim64 igd10iumd64 igd10iumd64 igd12umd64 igdumdim32 igd10iumd32 igd10iumd32 igd12umd32 Subsys ID: 00000000 RAM: 0 GPU #2 Active: No Description: NVIDIA GeForce 940MX Vendor ID: 0x10de Device ID: 0x134d Driver Version: 27.21.14.5167 Driver Date: 7-5-2020 Drivers: C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumdx.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumdx.dll C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumd.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumd.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumd.dll,C:\WINDOWS\System32\DriverStore\FileRepository\nvhm.inf_amd64_ce46a61dd6580c07\nvldumd.dll Subsys ID: 00000000 RAM: 4096 Diagnostics AzureCanvasBackend: direct2d 1.1 AzureCanvasBackend (UI Process): skia AzureContentBackend: direct2d 1.1 AzureContentBackend (UI Process): skia AzureFallbackCanvasBackend (UI Process): none CMSOutputProfile: AAAMSExpbm8CEAAAbW50clJHQiBYWVogB84AAgAJAAYAMQAAYWNzcE1TRlQAAAAASUVDIHNSR0IAAAAAAAAAAAAAAAAAAPbWAAEAAAAA0y1IUCAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARY3BydAAAAVAAAAAzZGVzYwAAAYQAAABsd3RwdAAAAfAAAAAUYmtwdAAAAgQAAAAUclhZWgAAAhgAAAAUZ1hZWgAAAiwAAAAUYlhZWgAAAkAAAAAUZG1uZAAAAlQAAABwZG1kZAAAAsQAAACIdnVlZAAAA0wAAACGdmlldwAAA9QAAAAkbHVtaQAAA/gAAAAUbWVhcwAABAwAAAAkdGVjaAAABDAAAAAMclRSQwAABDwAAAgMZ1RSQwAABDwAAAgMYlRSQwAABDwAAAgMdGV4dAAAAABDb3B5cmlnaHQgKGMpIDE5OTggSGV3bGV0dC1QYWNrYXJkIENvbXBhbnkAAGRlc2MAAAAAAAAAEnNSR0IgSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFhZWiAAAAAAAADzUQABAAAAARbMWFlaIAAAAAAAAAAAAAAAAAAAAABYWVogAAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAAts9kZXNjAAAAAAAAABZJRUMgaHR0cDovL3d3dy5pZWMuY2gAAAAAAAAAAAAAABZJRUMgaHR0cDovL3d3dy5pZWMuY2gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZGVzYwAAAAAAAAAuSUVDIDYxOTY2LTIuMSBEZWZhdWx0IFJHQiBjb2xvdXIgc3BhY2UgLSBzUkdCAAAAAAAAAAAAAAAuSUVDIDYxOTY2LTIuMSBEZWZhdWx0IFJHQiBjb2xvdXIgc3BhY2UgLSBzUkdCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRlc2MAAAAAAAAALFJlZmVyZW5jZSBWaWV3aW5nIENvbmRpdGlvbiBpbiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAACxSZWZlcmVuY2UgVmlld2luZyBDb25kaXRpb24gaW4gSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB2aWV3AAAAAAATpP4AFF8uABDPFAAD7cwABBMLAANcngAAAAFYWVogAAAAAABMCVYAUAAAAFcf521lYXMAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAKPAAAAAnNpZyAAAAAAQ1JUIGN1cnYAAAAAAAAEAAAAAAUACgAPABQAGQAeACMAKAAtADIANwA7AEAARQBKAE8AVABZAF4AYwBoAG0AcgB3AHwAgQCGAIsAkACVAJoAnwCkAKkArgCyALcAvADBAMYAywDQANUA2wDgAOUA6wDwAPYA+wEBAQcBDQETARkBHwElASsBMgE4AT4BRQFMAVIBWQFgAWcBbgF1AXwBgwGLAZIBmgGhAakBsQG5AcEByQHRAdkB4QHpAfIB+gIDAgwCFAIdAiYCLwI4AkECSwJUAl0CZwJxAnoChAKOApgCogKsArYCwQLLAtUC4ALrAvUDAAMLAxYDIQMtAzgDQwNPA1oDZgNyA34DigOWA6IDrgO6A8cD0wPgA+wD+QQGBBMEIAQtBDsESARVBGMEcQR+BIwEmgSoBLYExATTBOEE8AT+BQ0FHAUrBToFSQVYBWcFdwWGBZYFpgW1BcUF1QXlBfYGBgYWBicGNwZIBlkGagZ7BowGnQavBsAG0QbjBvUHBwcZBysHPQdPB2EHdAeGB5kHrAe/B9IH5Qf4CAsIHwgyCEYIWghuCIIIlgiqCL4I0gjnCPsJEAklCToJTwlkCXkJjwmkCboJzwnlCfsKEQonCj0KVApqCoEKmAquCsUK3ArzCwsLIgs5C1ELaQuAC5gLsAvIC+EL+QwSDCoMQwxcDHUMjgynDMAM2QzzDQ0NJg1ADVoNdA2ODakNww3eDfgOEw4uDkkOZA5/DpsOtg7SDu4PCQ8lD0EPXg96D5YPsw/PD+wQCRAmEEMQYRB+EJsQuRDXEPURExExEU8RbRGMEaoRyRHoEgcSJhJFEmQShBKjEsMS4xMDEyMTQxNjE4MTpBPFE+UUBhQnFEkUahSLFK0UzhTwFRIVNBVWFXgVmxW9FeAWAxYmFkkWbBaPFrIW1hb6Fx0XQRdlF4kXrhfSF/cYGxhAGGUYihivGNUY+hkgGUUZaxmRGbcZ3RoEGioaURp3Gp4axRrsGxQbOxtjG4obshvaHAIcKhxSHHscoxzMHPUdHh1HHXAdmR3DHeweFh5AHmoelB6+HukfEx8+H2kflB+/H+ogFSBBIGwgmCDEIPAhHCFIIXUhoSHOIfsiJyJVIoIiryLdIwojOCNmI5QjwiPwJB8kTSR8JKsk2iUJJTglaCWXJccl9yYnJlcmhya3JugnGCdJJ3onqyfcKA0oPyhxKKIo1CkGKTgpaymdKdAqAio1KmgqmyrPKwIrNitpK50r0SwFLDksbiyiLNctDC1BLXYtqy3hLhYuTC6CLrcu7i8kL1ovkS/HL/4wNTBsMKQw2zESMUoxgjG6MfIyKjJjMpsy1DMNM0YzfzO4M/E0KzRlNJ402DUTNU01hzXCNf02NzZyNq426TckN2A3nDfXOBQ4UDiMOMg5BTlCOX85vDn5OjY6dDqyOu87LTtrO6o76DwnPGU8pDzjPSI9YT2hPeA+ID5gPqA+4D8hP2E/oj/iQCNAZECmQOdBKUFqQaxB7kIwQnJCtUL3QzpDfUPARANER0SKRM5FEkVVRZpF3kYiRmdGq0bwRzVHe0fASAVIS0iRSNdJHUljSalJ8Eo3Sn1KxEsMS1NLmkviTCpMcky6TQJNSk2TTdxOJU5uTrdPAE9JT5NP3VAnUHFQu1EGUVBRm1HmUjFSfFLHUxNTX1OqU/ZUQlSPVNtVKFV1VcJWD1ZcVqlW91dEV5JX4FgvWH1Yy1kaWWlZuFoHWlZaplr1W0VblVvlXDVchlzWXSddeF3JXhpebF69Xw9fYV+zYAVgV2CqYPxhT2GiYfViSWKcYvBjQ2OXY+tkQGSUZOllPWWSZedmPWaSZuhnPWeTZ+loP2iWaOxpQ2maafFqSGqfavdrT2una/9sV2yvbQhtYG25bhJua27Ebx5veG/RcCtwhnDgcTpxlXHwcktypnMBc11zuHQUdHB0zHUodYV14XY+dpt2+HdWd7N4EXhueMx5KnmJeed6RnqlewR7Y3vCfCF8gXzhfUF9oX4BfmJ+wn8jf4R/5YBHgKiBCoFrgc2CMIKSgvSDV4O6hB2EgITjhUeFq4YOhnKG14c7h5+IBIhpiM6JM4mZif6KZIrKizCLlov8jGOMyo0xjZiN/45mjs6PNo+ekAaQbpDWkT+RqJIRknqS45NNk7aUIJSKlPSVX5XJljSWn5cKl3WX4JhMmLiZJJmQmfyaaJrVm0Kbr5wcnImc951kndKeQJ6unx2fi5/6oGmg2KFHobaiJqKWowajdqPmpFakx6U4pammGqaLpv2nbqfgqFKoxKk3qamqHKqPqwKrdavprFys0K1ErbiuLa6hrxavi7AAsHWw6rFgsdayS7LCszizrrQltJy1E7WKtgG2ebbwt2i34LhZuNG5SrnCuju6tbsuu6e8IbybvRW9j74KvoS+/796v/XAcMDswWfB48JfwtvDWMPUxFHEzsVLxcjGRsbDx0HHv8g9yLzJOsm5yjjKt8s2y7bMNcy1zTXNtc42zrbPN8+40DnQutE80b7SP9LB00TTxtRJ1MvVTtXR1lXW2Ndc1+DYZNjo2WzZ8dp22vvbgNwF3IrdEN2W3hzeot8p36/gNuC94UThzOJT4tvjY+Pr5HPk/OWE5g3mlucf56noMui86Ubp0Opb6uXrcOv77IbtEe2c7ijutO9A78zwWPDl8XLx//KM8xnzp/Q09ML1UPXe9m32+/eK+Bn4qPk4+cf6V/rn+3f8B/yY/Sn9uv5L/tz/bf// Display0: 1920x1080@60Hz DisplayCount: 1 GPUProcessPid: 16856 ClearType Parameters: Gamma: 1.8 Pixel Structure: RGB ClearType Level: 100 Enhanced Contrast: 50 Decision Log HW_COMPOSITING: available by default D3D11_COMPOSITING: available by default DIRECT2D: available by default D3D11_HW_ANGLE: available by default GPU_PROCESS: available by default WEBRENDER: opt-in by default: WebRender is an opt-in feature WEBRENDER_QUALIFIED: available by default blocklisted by env: No qualified hardware WEBRENDER_COMPOSITOR: available by default unavailable by runtime: No DirectComposition usage WEBRENDER_ANGLE: opt-in by default: WebRender ANGLE is an opt-in feature WEBRENDER_DCOMP_PRESENT: opt-in by default: WebRender DirectComposition is an opt-in feature OMTP: available by default ADVANCED_LAYERS: available by default WEBGPU: disabled by default: Disabled by default blocked by runtime: WebGPU can only be enabled in nightly

Media

Audio Backend: wasapi Max Channels: 2 Preferred Sample Rate: 48000 Roundtrip latency (standard deviation): NaNms (NaN) Output Devices Name: Group Speaker/Headphone (Realtek High Definition Audio): HDAUDIO\FUNC_01&VEN_10EC&DEV_0290&SUBSYS_103C819F&REV_1000\4&b572dae&0&0001 Input Devices Name: Group Microphone (Realtek High Definition Audio): HDAUDIO\FUNC_01&VEN_10EC&DEV_0290&SUBSYS_103C819F&REV_1000\4&b572dae&0&0001 Microphone Array (Realtek High Definition Audio): HDAUDIO\FUNC_01&VEN_10EC&DEV_0290&SUBSYS_103C819F&REV_1000\4&b572dae&0&0001 Mic in at front panel (black) (Realtek High Definition Audio): HDAUDIO\FUNC_01&VEN_10EC&DEV_0290&SUBSYS_103C819F&REV_1000\4&b572dae&0&0001 Stereo Mix (Realtek High Definition Audio): HDAUDIO\FUNC_01&VEN_10EC&DEV_0290&SUBSYS_103C819F&REV_1000\4&b572dae&0&0001

Enumerate database

Environment Variables

MOZ_CRASHREPORTER_DATA_DIRECTORY: C:\Users\jsign\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY: C:\Users\jsign\AppData\Roaming\Mozilla\Firefox\Crash Reports\events MOZ_CRASHREPORTER_PING_DIRECTORY: C:\Users\jsign\AppData\Roaming\Mozilla\Firefox\Pending Pings MOZ_CRASHREPORTER_RESTART_ARG_0: C:\Program Files\Mozilla Firefox\firefox.exe MOZ_CRASHREPORTER_STRINGS_OVERRIDE: C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini MOZ_PLUGIN_PATH: C:\Program Files (x86)\Nuance\PDF Professional 8\Bin\

Experimental Features

about:home startup cache (browser.startup.homepage.abouthome_cache.enabled): false Cookies: SameSite=Lax by default (network.cookie.sameSite.laxByDefault): false Cookies: SameSite=None requires secure attribute (network.cookie.sameSite.noneRequiresSecure): false Cookies: Schemeful SameSite (network.cookie.sameSite.schemeful): false CSS: Constructable Stylesheets (layout.css.constructable-stylesheets.enabled): false CSS: Pseudo-class: :focus-visible (layout.css.focus-visible.enabled): false CSS: Masonry Layout (layout.css.grid-template-masonry-value.enabled): false Developer Tools: Color Scheme Simulation (devtools.inspector.color-scheme-simulation.enabled): false Developer Tools: Compatibility Panel (devtools.inspector.compatibility.enabled): false Developer Tools: Execution Context Selector (devtools.webconsole.input.context): false Developer Tools: Service Worker debugging (devtools.debugger.features.windowless-service-workers): false Graphics: Smooth Pinch Zoom (apz.allow_zooming): false Media: AVIF (image.avif.enabled): false Web API: Media Session API (dom.media.mediasession.enabled): false Print Preview Redesign (print.tab_modal.enabled): false Web API: beforeinput Event (dom.input_events.beforeinput.enabled): false Web API: inputmode (dom.forms.inputmode): false Web API: <link rel="preload"> (network.preload): false Web API: WebGPU (dom.webgpu.enabled): false

Important Modified Preferences

accessibility.typeaheadfind.flashBar: 0 browser.cache.disk.amount_written: 698667 browser.cache.disk.capacity: 1048576 browser.cache.disk.filesystem_reported: 1 browser.cache.disk.hashstats_reported: 1 browser.cache.disk.smart_size.first_run: false browser.cache.disk.smart_size.use_old_max: false browser.cache.disk.telemetry_report_ID: 7 browser.cache.frecency_experiment: 3 browser.contentblocking.category: standard browser.download.useDownloadDir: false browser.places.smartBookmarksVersion: 8 browser.search.region: US browser.search.useDBForOrder: true browser.sessionstore.upgradeBackup.latestBuildID: 20200917005511 browser.startup.homepage_override.buildID: 20200917005511 browser.startup.homepage_override.mstone: 81.0 browser.startup.page: 3 browser.tabs.remote.autostart.2: true browser.urlbar.lastSuggestionsPromptDate: 20171014 browser.urlbar.matchBuckets: general:5,suggestion:Infinity browser.urlbar.placeholderName: Google browser.urlbar.placeholderName.private: Google browser.urlbar.timesBeforeHidingSuggestionsHint: 0 browser.urlbar.tipShownCount.searchTip_onboard: 4 dom.forms.autocomplete.formautofill: true dom.ipc.processCount.web: 4 dom.push.userAgentID: a01c14fc1e7e41638271b67b87193680 extensions.formautofill.addresses.enabled: false extensions.formautofill.firstTimeUse: false extensions.lastAppVersion: 81.0 font.internaluseonly.changed: true gfx.crash-guard.d3d11layers.appVersion: 56.0.1 gfx.crash-guard.d3d11layers.deviceID: 0x5916 gfx.crash-guard.d3d11layers.driverVersion: 21.20.16.4542 gfx.crash-guard.d3d11layers.feature-d2d: true gfx.crash-guard.d3d11layers.feature-d3d11: true gfx.crash-guard.status.d3d11layers: 2 gfx.crash-guard.status.d3d11video: 2 gfx.crash-guard.status.wmfvpxvideo: 2 gfx.crash-guard.wmfvpxvideo.appVersion: 81.0 gfx.crash-guard.wmfvpxvideo.deviceID: 0x5916 gfx.crash-guard.wmfvpxvideo.driverVersion: 21.20.16.4542 idle.lastDailyNotification: 1601791856 layers.mlgpu.sanity-test-failed: false media.benchmark.vp9.fps: 127 media.benchmark.vp9.versioncheck: 3 media.gmp-gmpopenh264.abi: x86_64-msvc-x64 media.gmp-gmpopenh264.lastUpdate: 1572149051 media.gmp-gmpopenh264.version: 1.8.1.1 media.gmp-manager.buildID: 20200917005511 media.gmp-manager.lastCheck: 1601653244 media.gmp-widevinecdm.abi: x86_64-msvc-x64 media.gmp-widevinecdm.lastUpdate: 1582704048 media.gmp-widevinecdm.version: 4.10.1582.2 media.gmp.storage.version.observed: 1 media.hardware-video-decoding.failed: false network.cookie.prefsMigrated: true network.predictor.cleaned-up: true network.trr.blocklist_cleanup_done: true network.trr.disable-ECS: false network.trr.experimentalPerfInterval: 0 network.trr.experimentalPerfRepeatCount: 0 network.trr.experimentalRollout: -2 network.trr.uri: places.database.lastMaintenance: 1601791857 places.history.expiration.transient_current_max_pages: 112348 plugin.disable_full_page_plugin_for_types: application/pdf plugin.flash.arch: x86_64-msvc plugin.flash.blockliststate: 0 plugin.flash.desc: Shockwave Flash 32.0 r0 plugin.flash.lastmod_hi: 372 plugin.flash.lastmod_lo: 1898285106 plugin.flash.path: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_433.dll plugin.flash.version: 32.0.0.433 plugins.ctprollout.cohort: test plugins.ctprollout.cohortSample: 0.427068 privacy.cpd.cookies: false privacy.cpd.sessions: false privacy.purge_trackers.date_in_cookie_database: 0 privacy.sanitize.pending: [{"id":"newtab-container","itemsToClear":[],"options":{}}] privacy.socialtracking.notification.counter: 2 privacy.socialtracking.notification.enabled: false privacy.socialtracking.notification.lastShown: 1572406683766 security.remote_settings.crlite_filters.checked: 1601863349 security.remote_settings.intermediates.checked: 1601690286 security.sandbox.content.tempDirSuffix: {357d5be2-8042-4277-9c52-b3a1a7b5104f} security.sandbox.plugin.tempDirSuffix: {5c203efb-aa8f-44f9-9875-e4d9cd332b8c} security.ssl.errorReporting.automatic: true security.tls.version.enable-deprecated: true services.sync.declinedEngines: services.sync.engine.addresses.available: true signon.importedFromSqlite: true signon.rememberSignons: false signon.usage.hasEntry: false storage.vacuum.last.index: 1 storage.vacuum.last.places.sqlite: 1600991534 ui.osk.debug.keyboardDisplayReason: IKPOS: Touch screen not found.

Important Locked Preferences

fission.autostart: false

Places Database

Accessibility

Activated: false Prevent Accessibility: 0 Accessible Handler Used: true Accessibility Instantiator:

Library Versions

NSPR Expected minimum version: 4.28 Version in use: 4.28

NSS Expected minimum version: 3.56 Version in use: 3.56

NSSSMIME Expected minimum version: 3.56 Version in use: 3.56

NSSSSL Expected minimum version: 3.56 Version in use: 3.56

NSSUTIL Expected minimum version: 3.56 Version in use: 3.56

Sandbox

Content Process Sandbox Level: 6 Effective Content Process Sandbox Level: 6

Startup Cache

Disk Cache Path: C:\Users\jsign\AppData\Local\Mozilla\Firefox\Profiles\qzqpj3fh.default\startupCache\startupCache.8.little Ignore Disk Cache: false Found Disk Cache on Init: true Wrote to Disk Cache: true

Internationalization & Localization

Application Settings Requested Locales: ["en-US"] Available Locales: ["en-US"] App Locales: ["en-US"] Regional Preferences: ["en-US"] Default Locale: "en-US" Operating System System Locales: ["en-US"] Regional Preferences: ["en-US"]

I've tried all the recommended fixes. Upgraded memory, file check, DISM, safe mode, refresh, update, etc. etc. Here are some of the infinite number of crash reports: Crash ID: bp-ab045501-5c4f-439e-b01c-23afa0201116 Crash ID: bp-654606c6-6616-4cc4-a6c5-1ee420201116 Crash ID: bp-413dbf26-b713-4be2-b6b5-d88440201116 Crash ID: bp-1c6d93f2-17ad-4b6b-b223-4f0010201116

good day. two days ago I was infected by poshukach probably when downloading Opera browser or a torrente file. So, whenever I initiate firefox I am redirected to poshukach browser instead. Question is: how can I get rid of poshukach? Thanks a lot

Last night my Firefox 94.0.2 was hacked. When running Firefox, it would lock up my desktop. It disabled Norton Security, it disable other installed security software, and it disabled Windows System Restore. The hacker put up a message claiming to be Microsoft Support, with a phone number to call for help. This was a scam. I ran Firefox refresh, and that removed the hacker's program from Firefox, but then I had to do a full repair of my Window's installation. To protect my system, and prevent this from happening again, I added "xpinstall.enabled = false" into about.config. Please let me know if this will prevent a web site from installing a dangerous hack into Firefox, or if there is something else that I need to do. I have used Firefox for years, and have never encountered this problem before. Firefox is my favorite browser, but I am now afraid to use it. Please advise me what to do. Thanks, Jim

Each morning, when I first cold boot my computer, the moment I open my Firefox browser, I receive numerous (10+) identical error messages from Bitdefender:

Suspicious connection blocked: Feature: Online Threat Prevention

firefox.exe attempted to establish a connection relying on an unmatching security certificate to content-signature-2.cdn.mozilla.net. We blocked the connection to keep your data safe since the used certificate was issued for a different web address than the targeted one.

Question: Is this ACTUALLY coming from Firefox? If so, please match your security certificates! If that's impossible due to a technical issue, then please email me your confirmation so that I can add an exception to Bitdefender.

Question: If it's not coming from Firefox, please email me, letting me know what additional system information you require so that we can get to the bottom of who/what is masquerading as Firefox while attempting to establish an unauthorized Internet connection from my computer.

HP Envy laptop, Windows 10 OS, latest update.

This has been occurring for several months.

Thank you for your time.

Hello This is a warning for the plugins section In the plugins section, there are a number of fake plugins called ledger live l of these plugins are counterfeit and steal trapped users' money, and my $ 42,000 has been stolen this way. Sama, you can compare the samples in the plugins section of your site with the original sample to find out if the samples in your site are counterfeit. Thieves with small changes in the logo and name of this plugin have entered a fake version of it in the plugins section of your site and are engaged in stealing with titles like ledger live and similar in the plugins section of your site and steal Please prevent further theft and activity of these fake plugins In the following link, all plugins are fake except speedledger , and you can find out if they are fake with a simple research and comparison with the original plugin, and all Ledger live fake plugins to prevent further theft and security of users from the plugin section.

https://addons.mozilla.org/fa/firefox/search/?platform=windows&q=ledger%20live

I can't find anything about a compromised Firefox update while using the browser when you go to help and let the browser update itself. It seems you've been hacked because I can't otherwise explain the firefox background update 308046BoAF4A39CB, which is been detected by my systems. I obviously have more information about this if you like, but I see nowhere how to report this properly. This is the first time this has happened to me, at least as far as I know and so far I've only detected the Tr.Gen threat on my Windows computers. I would like an adequate response from Mozilla on how this could happen and what the repercussions are plus how to avoid this in the future. I've been using the Firefox browser on all my systems with various operating systems and would prefer to keep using it, but not if your own updating process is comprimised. I also think it's idiotic that I can't upload a bigger screenshot than 1024 kb because my very relevant picture is 3084 kb in size.

Sincerely,

J.L

Long story short: Whenever I open Firefox, apparently a Russian search engine named 'Poshukach' hijacks my homepage and doesn't let me use google(Image attached). Now to solve this I scoured the Internet. I refreshed Firefox, ran malware scans and even re-installed windows. Still it doesn't go away. I installed Firefox in another device with the same account but to no avail. They while roaming through Firefox settings I noticed in the top that it says 'Your browser settings is managed by your organization' or something like that. So, I figured bad guys took control of my browser's settings disguising as my so called "organization" So, I need help from Firefox's end to solve this. Remove this Organization management stuff from my account. I want my control back. Otherwise, I am afraid I gotta stop using Firefox altogether due to privacy reasons

Following site is immediately hijacked to a scam site asking for login apparently to access private info. It happens with Firefox (only) whenever security setups are set "not to track", "not to prompt for passwords", "not to prompt for credit cards" "no history" "reset of cookies at logout" etc.. then the site below: http://thaimassage-herborn.de/ is redirected to SCAM SITE: https://xb7.serverdomain.org/admin/index.php appearing as "Adminpanel" asking for Login etc..

At the same time following site is partially blocked on the news banner pictures, with a white sheet over them, whenever down scroll is hit. https://www.tgrthaber.com.tr/

Only by resetting firefox deals with the issues. But ofcourse with the reason, above security settings removed.

Virusscanner was not able to detect this hijacking or the reason behind.

Is this a firefox software issue? Is there a way to resolve this? Thank you already for any support or suggestions to resolve.

I have tried everything that I can find to get rid of that damn searchitnow, which replaced my preferred Google Search. I've looked for downloads, extensions, everything. I've checked to make sure Google is my preferred search engine, and on and on. There is nothing. I have run Malwarebytes several times and it comes up clean.

How do I get this off my Mac? I am running OS X El Capitan 10.11.6.

I am positive about Firefox is the most secure browser and have evidence of it. Nevertheless the following site could traspass the Firefox barriers: https://www.eldestapeweb.com/ I am concerned on the survival of Free World and consecuently of Free Software. I guess the above mentioned site belongs to a parapolitical official organization. I consider that for it's job obtained tech help from some powerful international group. The average user of Firefox is unprevented of this issue. I am not asking for help in my behalf, because I have the necesary time to help myself. I suggest the Mozilla guys to investigate the facts. Sincery yours, Edgardo Colombo Buenos Aires.

Since there was an attempted hack a few weeks ago that firefox interrupted I have been unable to access my electric utility account. I tried working through the company trying to sign in to no avail even after changing id's and passwords numerous times. They told me they have done all they can at their end. I really would like to talk to someone who can help me. I'm 73 years old and do use my computer that often and am not really computer savvy. If you can help me, my phone number is [phone number]. I really hope to hear from somebody soon.

Hallo everyone! i have now a couple of days (search marquis) coming up when i start Mozilla :( I have on my Macbook MacAffe protection, but i dont know how to get out this Search Marquis ... Pls can anybody help me with that ?

Im used Firefox (v91.0.2 32bit) on Windows 10 Pro and anti-virus (Trend micro) alert has malware on FF to open website. im open https://www.cloudflare.com and then my use Google Chrome to open https://www.cloudflare.com and the anti-virus not alert warning. The Admin talk to me firefox has malware.!!!! (sorry for bad Eng.)

bold textMalware! My Facebook & Google accounts, (have been significantly compromised! This may include a deeper hack into the OS (?). Words just "appear", the messages get sent before I even press "send". Often the document is still in edit mode! When I do "send", I find that multiple duplicates were sent! What happened & what can I do about it?? Page frames flicker then realign. I don't trust fb anymore & What should I do? Both fb & google!! Google has most of my passwords! I've been watching it all degrade. Is the "Droid" Malware is suspected of anything.

Over a year of not being able to use our home computer in Seattle using Firefox. Microsoft punishes us for using Firefox in Seattle by placing any request or search on Firefox into a full Green Screen labeled PAUSE.

From there left with option to turn computer off. COMCAST Staff say this in not their fault. They receive about $80 month for internet service. My wife and I feel like we are criminals locked up in a high security prison in downtown Seattle, with no way to get out. HELP! HELP! SOS HELP!

... HP Windows Laptop Core i7

edited email from public and search/spam bots view.

Hi, My repaired computer came back today. Under https://accounts.firefox.com/settings/ Connected Services I found an entry <Firefox Mobile 95, Android 10> that signed into my account while the machine was under repair at the Lenovo repair centre. Not trusting it I immediately removed that account. Now I realize that that intruder might have had access to my passwords in Firefox (the machine was completely dead, so no precautions were possible). And therefore to have proof in the future of illegal access I should have made a screendump of the accounts overview. My question: is there a way to retrieve the history of old, but deleted, connected services to my Firefox account? Thx in advance! Ruurd

I need help! Everyday I have at least 8 Chinese Hackers that show up on on the top in the list of websites visited on my Firefox. The entire page is in Chinese with Chinese pictures. Please see the attached images. I have no idea how long they have been there prior to being so bold to openly show themselves. I certainly have no idea of what they have uploaded or downloaded on my laptop. How can I get rid of them and what can i do to prevent them coming back? I know a lot of weird things have been going on in my computer that I have absolutely no reason nor explanation for. this has been going on for at least the last couple of years or more. I have had 3 computers to crash in a short period of time which I feel they have done. Spyware shows I have had a keylogger for a long time but all of the files it takes me to are protected and I have not been able to delete them. BillCowanjr@gmail.com